diff --git a/packages/@aws-cdk/aws-ec2/lib/security-group.ts b/packages/@aws-cdk/aws-ec2/lib/security-group.ts
index e3b63b42f48af..ab66118204d2c 100644
--- a/packages/@aws-cdk/aws-ec2/lib/security-group.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/security-group.ts
@@ -432,7 +432,7 @@ export class SecurityGroup extends SecurityGroupBase {
         vpcId: options.vpc?.vpcId,
       },
       dummyValue: {
-        securityGroupId: 'sg-12345',
+        securityGroupId: 'sg-12345678',
         allowAllOutbound: true,
       } as cxapi.SecurityGroupContextResponse,
     }).value;
diff --git a/packages/@aws-cdk/aws-ec2/test/security-group.test.ts b/packages/@aws-cdk/aws-ec2/test/security-group.test.ts
index a480c53f58dfa..5a5e6e41a8009 100644
--- a/packages/@aws-cdk/aws-ec2/test/security-group.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/security-group.test.ts
@@ -516,7 +516,9 @@ describe('security group', () => {
       });
     });
   });
+});
 
+describe('security group lookup', () => {
   testDeprecated('can look up a security group', () => {
     const app = new App();
     const stack = new Stack(app, 'stack', {
@@ -528,7 +530,7 @@ describe('security group', () => {
 
     const securityGroup = SecurityGroup.fromLookup(stack, 'stack', 'sg-1234');
 
-    expect(securityGroup.securityGroupId).toEqual('sg-12345');
+    expect(securityGroup.securityGroupId).toEqual('sg-12345678');
     expect(securityGroup.allowAllOutbound).toEqual(true);
 
   });
@@ -547,7 +549,7 @@ describe('security group', () => {
     const securityGroup = SecurityGroup.fromLookupById(stack, 'SG1', 'sg-12345');
 
     // THEN
-    expect(securityGroup.securityGroupId).toEqual('sg-12345');
+    expect(securityGroup.securityGroupId).toEqual('sg-12345678');
     expect(securityGroup.allowAllOutbound).toEqual(true);
 
   });
@@ -571,7 +573,7 @@ describe('security group', () => {
     const securityGroup = SecurityGroup.fromLookupByName(stack, 'SG1', 'sg-12345', vpc);
 
     // THEN
-    expect(securityGroup.securityGroupId).toEqual('sg-12345');
+    expect(securityGroup.securityGroupId).toEqual('sg-12345678');
     expect(securityGroup.allowAllOutbound).toEqual(true);
 
   });
@@ -595,11 +597,35 @@ describe('security group', () => {
     const securityGroup = SecurityGroup.fromLookupByName(stack, 'SG1', 'my-security-group', vpc);
 
     // THEN
-    expect(securityGroup.securityGroupId).toEqual('sg-12345');
+    expect(securityGroup.securityGroupId).toEqual('sg-12345678');
     expect(securityGroup.allowAllOutbound).toEqual(true);
 
   });
 
+  test('can look up a security group and use it as a peer', () => {
+    // GIVEN
+    const app = new App();
+    const stack = new Stack(app, 'stack', {
+      env: {
+        account: '1234',
+        region: 'us-east-1',
+      },
+    });
+
+    const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
+      vpcId: 'vpc-1234',
+      availabilityZones: ['dummy1a', 'dummy1b', 'dummy1c'],
+    });
+
+    // WHEN
+    const securityGroup = SecurityGroup.fromLookupByName(stack, 'SG1', 'my-security-group', vpc);
+
+    // THEN
+    expect(() => {
+      Peer.securityGroupId(securityGroup.securityGroupId);
+    }).not.toThrow();
+  });
+
   test('throws if securityGroupId is tokenized', () => {
     // GIVEN
     const app = new App();
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts
index b181d086633e8..838897fa5dfe1 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts
@@ -1719,7 +1719,7 @@ describe('tests', () => {
       // THEN
       Template.fromStack(stack).resourceCountIs('AWS::ElasticLoadBalancingV2::Listener', 0);
       expect(listener.listenerArn).toEqual('arn:aws:elasticloadbalancing:us-west-2:123456789012:listener/application/my-load-balancer/50dc6c495c0c9188/f2f7dc8efc522ab2');
-      expect(listener.connections.securityGroups[0].securityGroupId).toEqual('sg-12345');
+      expect(listener.connections.securityGroups[0].securityGroupId).toEqual('sg-12345678');
     });
 
     test('Can add rules to a looked-up ApplicationListener', () => {
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/load-balancer.test.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/load-balancer.test.ts
index 102d016bf6bec..4124a222b7228 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/load-balancer.test.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/load-balancer.test.ts
@@ -579,7 +579,7 @@ describe('tests', () => {
       expect(loadBalancer.loadBalancerCanonicalHostedZoneId).toEqual('Z3DZXE0EXAMPLE');
       expect(loadBalancer.loadBalancerDnsName).toEqual('my-load-balancer-1234567890.us-west-2.elb.amazonaws.com');
       expect(loadBalancer.ipAddressType).toEqual(elbv2.IpAddressType.DUAL_STACK);
-      expect(loadBalancer.connections.securityGroups[0].securityGroupId).toEqual('sg-12345');
+      expect(loadBalancer.connections.securityGroups[0].securityGroupId).toEqual('sg-12345678');
       expect(loadBalancer.env.region).toEqual('us-west-2');
     });